Cookie Preferences

We use cookies to improve your experience and analyze site traffic. You can choose which cookies to allow.

Security

Trust Center

Ticket Committee is built with security and privacy at its core. Here's how we protect your data.

Security Controls

For Schools & Educational Organizations

Ticket Committee is designed with student data privacy in mind. We comply with FERPA and support standard Student Data Privacy Agreements.

Subprocessors

We use the following third-party services to operate Ticket Committee. Each maintains their own data processing agreements and security certifications.

Service Purpose
Laravel Cloud Application hosting
Stripe Payment processing
Twilio SMS notifications
Postmark Email delivery
AWS S3 File storage
Cloudflare CDN / WAF
Sentry Error monitoring

Policies & Legal

Student Data Privacy Agreement

Our general offer of privacy terms for schools

Privacy Policy

How we collect, use, and protect your data

Terms of Service

Terms governing use of Ticket Committee

Security Questions?

If you have questions about our security practices, need a copy of our security policies, or would like to discuss a Data Privacy Agreement, we're here to help.

Contact Us
NIST Cybersecurity Framework 1.1

Ticket Committee's security program is aligned with the NIST Cybersecurity Framework Version 1.1, covering all five core functions:

IDENTIFYAsset management, risk assessments, data classification, and supply chain oversight for all subprocessors.
PROTECTEncryption at rest and in transit, role-based access control, security headers, account lockout, employee training, and data retention policies.
DETECTBaseline-aware anomaly detection, real-time authentication monitoring, SQL injection detection, and comprehensive audit logging.
RESPONDWritten incident response plan, automated mitigation (account lockout, IP blocking), 72-hour school notification, and post-incident review.
RECOVERDisaster recovery plan, automated backups with point-in-time recovery, and documented recovery procedures.

This framework is required by the New York State Education Department (NYSED) for all vendors handling student data and is recognized across all 50 states.
SOC 2 Type 2 Certification

Ticket Committee is hosted on Laravel Cloud, which has achieved SOC 2 Type 2 certification covering Security, Confidentiality, and Availability.

SOC 2 Type 2 means an independent auditor has verified that Laravel Cloud's security controls are not only properly designed (Type 1) but have been operating effectively over a sustained period (Type 2).

What this covers:

  • Physical and logical access controls
  • Network and infrastructure security
  • Data encryption and confidentiality
  • System availability and uptime
  • Incident response procedures

For more information, visit the Laravel Trust Center.
FERPA Compliance

Ticket Committee supports compliance with the Family Educational Rights and Privacy Act (FERPA) and the Student Data Privacy Consortium (SDPC) standard Data Privacy Agreement.

How we comply:

  • We act as a "School Official" under the direct control of the school
  • Student data used only for contracted event management purpose
  • No student data sold, used for advertising, or shared with unauthorized parties
  • Data can be exported or permanently deleted on request within 60 days
  • Breach notification within 72 hours of confirmation
  • Annual audit support with 10 business days' notice

We support the 16-state SDPC standard DPA and can work with your school's specific data privacy requirements.
US Data Residency

All Ticket Committee data is stored in the United States.

Storage locations:

  • Application & Database: Laravel Cloud (AWS US-East)
  • File Storage: AWS S3 (US region)
  • Edge Network: Cloudflare (global, but data at rest is US-based)

This meets data residency requirements under applicable state student data privacy laws.
Infrastructure Security

Ticket Committee runs on Laravel Cloud, a SOC 2 Type 2 certified hosting platform built on AWS infrastructure.

Security layers:

  • Cloudflare WAF — OWASP Core Ruleset filters injection, authentication, and data exposure attacks at the edge
  • DDoS Protection — Mitigated across 335 global edge locations
  • TLS Encryption — All traffic encrypted in transit
  • Automated Backups — Managed database with point-in-time recovery
  • Security Headers — HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy
Data Protection

Encryption at rest:

  • Guardian names and custom form responses encrypted with AES-256
  • Payment tokens encrypted before storage
  • Session data encrypted in database storage
  • Credit card numbers never stored — processed by Stripe (PCI DSS)

Data retention:

  • Configurable retention periods per organization (30 days to 3 years)
  • Separate controls for attendee data, communications, and IP addresses
  • Optional automated purge of expired data
Access Control

Role-based permissions:

  • Owner — Full access, billing, member management
  • Admin — Event management and attendee access
  • Member — Read-only access

Automated threat response:

  • Account locked after 10 failed login attempts (30-min lockout)
  • IP blocked after 20 failed attempts from same address (1-hour block)
  • Login rate limiting (5 attempts per minute)
  • Optional owner-only data export restriction
Monitoring & Detection

Ticket Committee continuously monitors for unusual activity using baseline-aware anomaly detection.

What we detect:

  • Credential stuffing and brute force attacks
  • Unusual login volume vs. user's baseline
  • Login from new or unrecognized IP addresses
  • Off-hours login activity
  • Unusual data export volume
  • SQL injection and attack pattern attempts

All sensitive operations are logged, including member role changes, data exports, account restrictions, and authentication events. Audit reports can be generated on demand.
Data Minimization

Ticket Committee collects the minimum data necessary to provide event ticketing services.

Collected by default:

  • Attendee first and last name
  • Orderer information (name, email, address)
  • Communication records (SMS/email content when sent)

Only collected if the school enables it:

  • Parent/guardian contact information (check-in alerts)
  • Custom registration question answers
  • Check-in/check-out timestamps
  • Waiver signatures and guardian details
  • Cookies/analytics (requires user consent via banner)

The school controls all additional data collection. We recommend schools apply data minimization principles when configuring registration forms.
Advertising Restrictions

Meta (Facebook) Pixel tracking is automatically disabled for all organizations marked as educational.

Non-educational organizations can also disable Meta Pixel via their Privacy Settings. When disabled:

  • No tracking code loaded on public event pages
  • No user data shared with Meta/Facebook
  • No student profiles created for advertising

Student data is never used for targeted advertising, in compliance with FERPA and applicable state privacy laws.
Data Disposition

Schools can request deletion of student data at any time, and we will comply within 60 days of the request.

Deletion capabilities:

  • Individual deletion — Remove a specific attendee and all related data
  • Bulk deletion — Purge all attendee data for an organization or event
  • Data export — Export all data before deletion for records
  • Automated retention — Optional automatic purge after configurable period

Deletion covers attendee records, custom form answers, waiver submissions, and communication events. All deletions are logged for audit purposes.
Incident Response

We maintain a written Incident Response Plan with defined severity levels and response procedures.

Severity Example Response
P1 Confirmed breach Immediate; schools within 72h
P2 Suspected breach Within 1 hour; auto-blocking
P3 Failed login threshold Automatic mitigation
P4 New IP login Logged and monitored

Our response plan covers containment, investigation, eradication, recovery, evidence preservation, and post-incident review. A copy is available upon request.